CVE-2025-10151 - Vulnerability Details - OpenCVE

Improper locking vulnerability in Softing Industrial Automation GmbH gateways allows infected memory and/or resource leak exposure.This issue affects

smartLink HW-PN: from 1.02 through 1.03

smartLink HW-DP: 1.31

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

This issue is fixed in smartLink HW-PN: 1.04 smartLink HW-DP: 1.32

Workaround

No workaround given by the vendor.

References

Link	Providers
https://https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-10151.html
https://https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-10151.json

History

Tue, 28 Oct 2025 07:45:00 +0000

Type	Values Removed	Values Added
Description		Improper locking vulnerability in Softing Industrial Automation GmbH gateways allows infected memory and/or resource leak exposure.This issue affects smartLink HW-PN: from 1.02 through 1.03 smartLink HW-DP: 1.31
Title		Malicious TCP/IP thread locking leads into diverse malfunctions
Weaknesses		CWE-667
References		https://https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-10151.html https://https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-10151.json
Metrics		cvssV4_0 `{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/AU:Y/R:U/RE:M/U:Amber'}`

MITRE

Status: PUBLISHED

Assigner: Softing

Published: 2025-10-28T07:25:39.639Z

Updated: 2025-10-28T07:25:39.639Z

Reserved: 2025-09-09T07:27:10.152Z

Link: CVE-2025-10151

Vulnrichment

No data.

NVD

Status : Received

Published: 2025-10-28T08:15:32.917

Modified: 2025-10-28T08:15:32.917

Link: CVE-2025-10151

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-10151", "assignerOrgId": "10de8ef9-5c89-4b17-8228-e97b74acf4bd", "state": "PUBLISHED", "assignerShortName": "Softing", "dateReserved": "2025-09-09T07:27:10.152Z", "datePublished": "2025-10-28T07:25:39.639Z", "dateUpdated": "2025-10-28T07:25:39.639Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "smartLink HW-PN", "vendor": "Softing Industrial Automation GmbH", "versions": [{"lessThanOrEqual": "1.03", "status": "affected", "version": "1.02", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "smartLink HW-DP", "vendor": "Softing Industrial Automation GmbH", "versions": [{"lessThanOrEqual": "1.31", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper locking vulnerability in Softing Industrial Automation GmbH gateways allows infected memory and/or resource leak exposure.<p>This issue affects</p><p>smartLink HW-PN: from 1.02 through 1.03</p><p>smartLink HW-DP: 1.31</p>"}], "value": "Improper locking vulnerability in Softing Industrial Automation GmbH gateways allows infected memory and/or resource leak exposure.This issue affects\n\nsmartLink HW-PN: from 1.02 through 1.03\n\nsmartLink HW-DP: 1.31"}], "impacts": [{"capecId": "CAPEC-456", "descriptions": [{"lang": "en", "value": "CAPEC-456 Infected Memory"}]}, {"capecId": "CAPEC-131", "descriptions": [{"lang": "en", "value": "CAPEC-131 Resource Leak Exposure"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7.2, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/AU:Y/R:U/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-667", "description": "CWE-667 Improper Locking", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "10de8ef9-5c89-4b17-8228-e97b74acf4bd", "shortName": "Softing", "dateUpdated": "2025-10-28T07:25:39.639Z"}, "references": [{"tags": ["x_html"], "url": "https://https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-10151.html"}, {"tags": ["x_json"], "url": "https://https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-10151.json"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>This issue is fixed in</p><p>smartLink HW-PN: 1.04</p><p>smartLink HW-DP: 1.32</p>"}], "value": "This issue is fixed in\n\nsmartLink HW-PN: 1.04\n\nsmartLink HW-DP: 1.32"}], "source": {"discovery": "INTERNAL"}, "title": "Malicious TCP/IP thread locking leads into diverse malfunctions", "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper locking vulnerability in Softing Industrial Automation GmbH gateways allows infected memory and/or resource leak exposure.This issue affects\n\nsmartLink HW-PN: from 1.02 through 1.03\n\nsmartLink HW-DP: 1.31"}], "id": "CVE-2025-10151", "lastModified": "2025-10-28T08:15:32.917", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "source": "10de8ef9-5c89-4b17-8228-e97b74acf4bd", "type": "Secondary"}]}, "published": "2025-10-28T08:15:32.917", "references": [{"source": "10de8ef9-5c89-4b17-8228-e97b74acf4bd", "url": "https://https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-10151.html"}, {"source": "10de8ef9-5c89-4b17-8228-e97b74acf4bd", "url": "https://https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-10151.json"}], "sourceIdentifier": "10de8ef9-5c89-4b17-8228-e97b74acf4bd", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "10de8ef9-5c89-4b17-8228-e97b74acf4bd", "type": "Secondary"}]}